Yes you do have to [pay for a security certificate which is why a lot of small, independent Poser sites will only accept payments via Paypal rather than credit or debit cards direct through the site - Paypal chages are significantly lower than paying for the necessary certifiation for an SSL.